Description

Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation created in one organization (potentially as a role with elevated permissions) can be used to join any other organization. This bypasses any restrictions on required domains on users' email addresses, may be used to gain access to organizations which are only accessible by invitation, and may be used to gain access with elevated privileges. This issue has been patched in release 4.10. There are no known workarounds for this issue. ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory, you can discuss them on the [developer community Zulip server](https://zulip.com/developer-community/), or email the [Zulip security team](mailto:security@zulip.com).

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  9.8 CRITICAL

Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA:  GitHub, Inc.

Base Score:  7.2 HIGH

Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score:  7.5 HIGH

Vector:  (AV:N/AC:L/Au:N/C:P/I:P/A:P)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://blog.zulip.com/2022/02/25/zulip-cloud-invitation-vulnerability/	Vendor Advisory
https://blog.zulip.com/2022/02/25/zulip-server-4-10-security-release/#cve-2022-21706	Vendor Advisory
https://github.com/zulip/zulip/commit/88917019f03860609114082cdc0f31a561503f9e	Patch  Third Party Advisory
https://github.com/zulip/zulip/security/advisories/GHSA-6xmj-2wcm-p2jc	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-Other	Other	NIST
CWE-863	Incorrect Authorization	GitHub, Inc.
CWE-284	Improper Access Control	GitHub, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

3 change records found show changes

CVE Modified by GitHub, Inc. 5/14/2024 6:10:13 AM

Action	Type	Old Value	New Value

Reanalysis by NIST 7/24/2023 9:47:59 AM

Action	Type	Old Value	New Value
Added	CWE		NIST NVD-CWE-Other
Removed	CWE	NIST CWE-863

Initial Analysis by NIST 3/08/2022 10:11:47 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR *cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:* versions from (including) 2.0.0 up to (excluding) 4.10.0
Added	CVSS V2		NIST (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Added	CVSS V3.1		NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CWE		NIST CWE-863
Changed	Reference Type	https://blog.zulip.com/2022/02/25/zulip-cloud-invitation-vulnerability/ No Types Assigned	https://blog.zulip.com/2022/02/25/zulip-cloud-invitation-vulnerability/ Vendor Advisory
Changed	Reference Type	https://blog.zulip.com/2022/02/25/zulip-server-4-10-security-release/#cve-2022-21706 No Types Assigned	https://blog.zulip.com/2022/02/25/zulip-server-4-10-security-release/#cve-2022-21706 Vendor Advisory
Changed	Reference Type	https://github.com/zulip/zulip/commit/88917019f03860609114082cdc0f31a561503f9e No Types Assigned	https://github.com/zulip/zulip/commit/88917019f03860609114082cdc0f31a561503f9e Patch, Third Party Advisory
Changed	Reference Type	https://github.com/zulip/zulip/security/advisories/GHSA-6xmj-2wcm-p2jc No Types Assigned	https://github.com/zulip/zulip/security/advisories/GHSA-6xmj-2wcm-p2jc Third Party Advisory